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Introduction 


The Information Commissioner is seeking feedback on her draft code of 
practice Age appropriate design - a code of practice for online services 
likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. 


The code is now out for public consultation and will remain open until 31 
May 2019. The Information Commissioner welcomes feedback on the 
specific questions set out below. 


Please send us your comments by 31 May 2019. 


Download this document and email to: 


ageappropriatedesign@ico.org.uk 


Print off this document and post to: 
Age Appropriate Design code consultation 
Policy Engagement Department 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation please 
telephone 0303 123 1113 and ask to speak to the Policy 
Engagement Department about the Age Appropriate Design code or 


email_ageappropriatedesign@ico.org.uk 


Privacy statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
Capacity (e.g. a member of the public or a parent). All responses from 
organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, 
education professionals) will be published. We will remove email 
addresses and telephone numbers from these responses but apart from 
this, we will publish them in full. 


For more information about what we do with personal data, please see 
our privacy notice. 


Section 1: Your views 


Q1. Is the ‘About this code’ section of the code clearly communicated? 


No 
If NO, then please provide your reasons for this view. 


Whilst the "About this code’ section is well-written and readily readable, 
when considered in relation to our sector: educational establishments in 
the UK, it would be beneficial to provide further details on the relevance 
of the term ISS when applied to an educational (specifically school) 
setting. With the wide variation in establishments and a continued lack 
of clarity around the roles and reponsibilities between educational 
establishments as data controllers and providers of ISS as data 
processors this additional detail would further help educational 
establishments more adequately understand their position. 


Q2. Is the ‘Services covered by this code’ section of the code clearly 
communicated? 


No 
If NO, then please provide your reasons for this view. 


Similarly to above, it may be that between these two sections further 
clarification can be provided for any sector making use of ISS and 
proving these to their clients. The term ISS is not well-known beyond 


DP specialists, further work to exemplify what is/is not an ISS within 
this section would further help organisations identify if they are indeed a 
provider. Perhaps a simple table with some examples of ISS/Not ISS 
would be appropriate? 

By way of further example - 'Likely to be accessed by children’ - clearly 
many educational establishments provide services that are, indeed, 
accessed by children, such as maths apps and websites where children 
learn through gaming. These are an ISS, but as ICO guidance 
(https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to- 
the-general-data-protection-regulation-gdpr/children-and-the- 
gdpr/what-are-the-rules-about-an-iss-and-consent/) states "If an ISS is 
only offered through an intermediary, such as a school, then it is not 
offered ‘directly’ to a child", meaning that the school is not the ISS 
provider. This section provides a further opportunity to clarify this for 
the benefit of our sector. 

The third paragraph of the 'Does it apply to services based outside the 
UK?' reads in a slightly misleading way and appears to contradict some 
of the statements made in paragraphs 1 and 2. 


Standards of age-appropriate design 


Please provide your views on the sections of the code covering each of 
the 16 draft standards 


1. Best interests of the child: The best interests of the child should be 
a primary consideration when you design and develop online services 
likely to be accessed by a child. 


2. Age-appropriate application: Consider the age range of your 
audience and the needs of children of different ages. Apply the standards 
in this code to all users, unless you have robust age-verification 
mechanisms to distinguish adults from children. 


3. Transparency: The privacy information you provide to users, and 
other published terms, policies and community standards, must be 


concise, prominent and in clear language suited to the age of the child. 
Provide additional specific ‘bite-sized’ explanations about how you use 
personal data at the point that use is activated. 


4. Detrimental use of data: Do not use children’s personal data in ways 
that have been shown to be detrimental to their wellbeing, or that go 
against industry codes of practice, other regulatory provisions or 
Government advice. 


5. Policies and community standards: Uphold your own published 
terms, policies and community standards (including but not limited to 
privacy policies, age restriction, behaviour rules and content policies). 


6. Default settings: Settings must be ‘high privacy’ by default (unless 
you can demonstrate a compelling reason for a different default setting, 
taking account of the best interests of the child). 


7. Data minimisation: Collect and retain only the minimum amount of 

personal data necessary to provide the elements of your service in which 
a child is actively and knowingly engaged. Give children separate choices 
over which elements they wish to activate. 


8. Data sharing: Do not disclose children’s data unless you can 
demonstrate a compelling reason to do so, taking account of the best 
interests of the child. 


9. Geolocation: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the 
best interests of the child), and provide an obvious sign for children when 
location tracking is active. Options which make a child’s location visible to 
others must default back to off at the end of each session. 


10. Parental controls: If you provide parental controls give the child 
age appropriate information about this. If your online service allows a 
parent or carer to monitor their child’s online activity or track their 
location, provide an obvious sign to the child when they are being 
monitored. 


11. Profiling: Switch options based on profiling off by default (unless you 
can demonstrate a compelling reason for profiling, taking account of the 
best interests of the child). Only allow profiling if you have appropriate 
measures in place to protect the child from any harmful effects (in 
particular, being fed content that is detrimental to their health or 
wellbeing). 


12. Nudge techniques: Do not use nudge techniques to lead or 
encourage children to provide unnecessary personal data, weaken or turn 
off privacy protections, or extend use. 


13. Connected toys and devices: If you provide a connected toy or 
device ensure you include effective tools to enable compliance with this 
code 


14. Online tools: Provide prominent and accessible tools to help children 
exercise their data protection rights and report concerns. 


15. Data protection impact assessments: Undertake a DPIA 
specifically to assess and mitigate risks to children who are likely to 
access your service, taking into account differing ages, capacities and 
development needs. Ensure that your DPIA builds in compliance with this 
code. 


16. Governance and accountability: Ensure you have policies and 
procedures in place which demonstrate how you comply with data 
protection obligations, including data protection training for all staff 
involved in the design and development of online services likely to be 
accessed by children. Ensure that your policies, procedures and terms of 
service demonstrate compliance with the provisions of this code 


Q3. Have we communicated our expectations for this standard clearly? 
1. Best interests of the child 


No 


The expectations for this standard are communicated clearly, but 
there would be great advantages in providing more practical 
guidance to industry on how to address this principle. Such 
examples are given elsewhere in the Code, and it would be valuable 
to include some here to help guide industry. 


Internet industry may face challenges establishing the best 
interests of the child at the point of designing new features for 


existing software, updates or designing new programs, because this 
requirement will indicate a new framework within which to work, 
that implies consulting with children and young people, taking their 
views into account and balancing their needs with other business 
needs. 


Under section 15, Data Protection Impact Assessments, the Code 
suggests ways of addressing this need including, for example, 
consultation with young people, which could be referred to here. 
Case studies and examples from industry, civil society or other 
organisations would help to contextualise this, and the Code could 
also point to opportunities for working in partnership with civil 
society in order to help meet the standard. 


2. Age-appropriate application 
No 


In sections 6 and 13 of the Code, there is relevant information about 
shared devices, smart toys and non-screen internet enabled tech. Section 
2 of the Code could provide extra clarity by including references to these 
sections, and to the age-appropriate application needed to meet the 
standard as regards shared devices e.g. smart speakers. 

3. Transparency 

No 


The need to be concise and clear to cater for the needs of younger users 
when communicating about community standards is really important, and 
the guide makes this very practical. However, the Code currently makes 
no mention of children who may have specific needs in relation to the 
transparency of published terms, for instance children who are visually 
impaired, for instance, or who have special educational needs or 
disabilities. The Code should outline its expectation that online services 
consider those children with specific needs in relation to transparency. 

4. Detrimental use of data 


No 


The communication about the Standard is clear but could provide more 
context and clarity here by additionally providing a few case studies or 
examples to illustrate what it means by processing data in obviously 
detrimental ways. 


5. Policies and community standards 
No 


The communication of the standard is mostly clear, but it would help to 
provide examples in relation to the point on age restriction — is it possible 
to add some examples as to the types of systems in place that could be 
applied here? The text could also refer back to section 2 of the Code and 
could help provide extra clarity for online services to put in the most 
appropriate age identifying measures in order to uphold their own age 
restriction policies. Listing Policies and Community Standards as a 
relevant area to consider under section 2 of the code, alongside the other 
areas on p.26 could also provide further clarity. 

6. Default settings 

Yes 


We agree that this section is communicated clearly. If there is scope to 
provide examples of what a ‘compelling reason’ might be, that would be 
helpful. 


However, there is a clear educational opportunity which is not mentioned 
in the section on defaults, which we would want to see included here. 


Where defaults are set high, and the user acitvely selects to lower their 
settings, there is a clear timely moment and an opportunity to ensure the 
user is fully aware of the change they are making. It is important that 
online services make full use of this opportunity as users make a 
deliberate choice to change their settings, to ensure it is an informed 
choice 

7. Data minimisation 

Yes 


If NO, then please provide your reasons for this view. 
8. Data sharing 
Yes 


If NO, then please provide your reasons for this view. 
9. Geolocation 
No 


It would be of practical use to provide some further information on what 
would constitute a compelling reason. For instance, would a mapping or 
transport app that is designed to provide users with directions and 
recommendations, have a compelling reason to use geolocation by 
default? 


If this is not a compelling reason, it would be helpful to outline what the 
expectation would look like in practice. 


It would be helpful to provide more explanation of is meant by 
granularity. 


The text could consider proposing the use of geo-fencing as applied by 
some online providers to educational establishments rendering them 'not- 
spots' to access the service. 

10. Parental controls 

Yes 


If NO, then please provide your reasons for this view. 


11. Profiling 
No 


Profiling can have positive purposes, and can be tied to online 
protections. For example, if a service thinks that a user is a child, it 
can prevent them being served age-inappropriate advertising etc, 
or even have restricted sets of options available in their privacy 
settings. Child protection is mentioned briefly on p62, and is given 
as an example on p64 as a compelling argument to switch profiling. 


In this section of the Code, we would like to see examples of the positive 
uses of profiling in order to protect children and young people from harm. 
Greater clarity on the limits of this would be of practical use. 


12. Nudge techniques 
Yes 


If NO, then please provide your reasons for this view. 
13. Connected toys and devices 
Yes 


If NO, then please provide your reasons for this view. 
14. Online tools 
Yes 


If NO, then please provide your reasons for this view. 
15. Data protection impact assessments 
No 


The Code could provide more context by including summary wording of 
Article 12 of the UNCRC as part of Step 3 of the process around 
developing DPIAs. The UNCRC states that children have a right to be 
consulted and heard in matters affecting them. This element of Article 12 
is not currently included under section 1 of the Code (Best interests of the 
child) and would provide clarity about the rationale for the responsibility 
to consult if it was included here. 


Including this reference at this point in the Code would encourage 
business to consult with children and young people, and would provide 
more guidance to online services when considering their responsibilities 
under step 3. 

16. Governance and accountability 


Yes 


If NO, then please provide your reasons for this view. 


Q4. Do you have any examples that you think could be used to illustrate 
the approach we are advocating for this standard? 


1. Best interests of the child 


No 


If YES, then please provide details. 


2. Age-appropriate application 
Yes 


Education for a Connected World Framework 
https://www.gov.uk/government/publications/education-for-a-connected- 
world 


There are businesses acting in this space already taking steps to ensure 
that their online environments are age-appropriate for their users. The 
Code could support business to embed better practice by referring to 
examples of improvements such as these outside the core Code 
document, e.g. as case studies on the ICO website. 

3. Transparency 

Yes 


We have become familiar with labels for many aspects of life, for 
example nutrional labelling on food packaging, laundry labelling and eco 
labelling on devices. We are advocating the creation of a labelling 
schema for T&Cs and Privacy statements. This would alow users, at a 
glance, to have an appreciation of the exent of the collection, and use of 
personal data in a similar way. Having conducted research, the Polisis 
project (https://pribot.org/polisis/) from Ecole Polytechnique Federale de 
Lausanne, uses AI to read and interpret Terms and Conditions and 
present them in a visual manner. A further example was developed by 
researchers at Carnegie Mellon and Columbia Universities, called Useable 
Privacy.org, this service uses a blend of machine learning, AI and natural 
processing to display terms in a visual matrix. 


Terms and conditions and privacy statements should be suitable for the 
minimum age the service is designed for. For example, for over 13's the 
terms should be written with a complexity of language that a 13 year old 
can understand. As a matter of course, encouraging providers to use a 
readbility index, such as the Gunning Fog index (http://gunning-fog- 
index.com/), to verify that their terms are written with appropriate 
complexity would be a positive step. 


The average reading age in the UK is nine - reading ages are not 
mentioned in the Code and would be supportive and provide clarity here. 
PIRLS - Progress in International Reading Literacy Study 
https://www.iea.nl/pirls 

4. Detrimental use of data 


No 
If YES, then please provide details. 


5. Policies and community standards 
Yes 


The majority of providers provide reporting mechanims to report 
violations of their policies. SWGfL, on behalf of the UK Safer Inernet 
Cetre, recently launched report harmful content.com, the national 
reporting hub for reporting online harm. Users who have reported content 
to a provder but are not content with the response are able to obtain 
support from report harmful content.com in terms of advice, support and 
mediation. The UK Safer Internet Centre asses these reports against the 
providers terms and through understanding and navigation of terms and 
conditions is able to support users. 

6. Default settings: 

No 


7. Data minimisation 
Yes 


Specifically concerning the example used in the wording of the Code 
around data collection when a child is actively using the maps element: 
we would recommend not suggesting a ‘light’ as a possible solution. If 
this is a solution adopted widely, one unintended consequence may be 
that many children won't want to opt for this because they would be 
concerned that extra light could drain their device battery quicker. They 
would therefore choose to opt out because of their concerns around 
battery life, rather than in response to informed choices about their 
privacy and data protection. We would recommend listing an alternative 
example e.g. an icon on screen. 

8. Data sharing 


No 


If YES, then please provide details. 
9. Geolocation 
No 


If YES, then please provide details. 
10. Parental controls 
No 


If YES, then please provide details. 
11. Profiling 
No 


If YES, then please provide details. 
12. Nudge techniques 
YES/NO. 


If YES, then please provide details. 


13. Connected toys and devices 
No 


If YES, then please provide details. 


14. Online tools 
No 


If YES, then please provide details. 


15. Data protection impact assessments 
No 


If YES, then please provide details. 
16. Governance and accountability 


No 


If YES, then please provide details. 


Q5. Do you think this standard gives rise to any unwarranted or 
unintended consequences? 


1. Best interests of the child 


No 


If YES, then please provide your reasons for this view. 


2. Age-appropriate application 
Yes 


There are two areas of concern with regards to age-appropriate 
applications: 1 - using age ranges does not take into account the 
cognitive skill level of the child and whilst it does enable a broad set of 
principles to be applied to a child's usage of an application, the range of 
cognitive levels displayed by maturing children will influence their ability 
to make appropriate decisions. The issue of those children with special 
needs is mentioned in Appendix A, but it would be helpful if this was also 
included in the main text of the code. Furthermore, whilst consideration is 
given to the difficulties children may have in obtaining adult support, or 
identity documents, there is not enough consideration given to those 
children wishing to access a service suitable for their needs and with good 
cognitive skills that have neither adult support or identity documents - 
this situation may be unpalatable for children and providers alike. 

2 - whilst the code suggests age-verification alongside other models of 
age identification, the two other models are signficantly weaker and may 
preclude some services from being accessed by older children. Whilst it's 
right that the application should be designed in a way as to prioritise the 
safety and safeguarding of children, other models of identifying their age 
should be considered. 

3. Transparency 

No 


If YES, then please provide your reasons for this view. 
4. Detrimental use of data 


Yes 


The academic position on screentime is still developing and refining its 
focus with multiple studies identifying different positions. We recommend 
a cautious position should be taken on this standard of the code. 


5. Policies and community standards 
Yes 


We welcome the aspiration to uphold the published terms and community 
standards thereby reducing the levels of innapropriate or unacceptable 
content that children might encounter. Many social media companies 
have invested heavily in moderation teams involving a blend of computer 
and human interventions and this is beginning to have impact, but more 


work is still required in this regard. Smaller, start-up companies will find 
the requirement to "have mechanisms in place to swifty and effectively 
deal with" unacceptable content difficult in the short term. This could 
result in people in the UK being unable to access some new unsafe 
applications until they can meet the standards to the Code. 

6. Default settings 

No 


If YES, then please provide your reasons for this view. 
7. Data minimisation 
No 


If YES, then please provide your reasons for this view. 
8. Data sharing 
No 


If YES, then please provide your reasons for this view. 
9. Geolocation 
Yes 


Specifically in this section of the code, what is a 'session' when using a 
service? Many services remain on in the background after the app is 
‘closed’. Greater clarity and visibility would be helpful in understanding 
what the triggers are for geolocation reverting back to 'off'. 

10. Parental controls 

Yes 


Many of the apps and services made available through the app stores are 
associated with age ratings defined by the app store provider. Whilst 
these are a helpful guide for young people and parents alike, limited 
easy-to-access information is provided and they can misrepresent the 
terms and conditions of the provider. The collection of data that governs 
the use of services, in some cases, does not form part of the age rating 
process. The code should guide app stores to incorporate the age 
requirements of the providers' own terms and conditions into the 
published age rating for the app on the app store. An app designed for 
over 13's should never be presented as suitable for over 4s, for example. 
11. Profiling 

No 


If YES, then please provide your reasons for this view. 
12. Nudge techniques 
No 


If YES, then please provide your reasons for this view. 
13. Connected toys and devices 


Yes 


Again, whilst we support the requirement to be clear about the 
processing of personal data we recommend that providers consider the 
use of simple and easy-to-access privacy labelling. It would be beneficial 
to see the inclusion of a labelling requirement on the packaging to 
support the decision-making process by providing a range of colour-coded 
icons highlighting the areas of privacy and data protection risk. 

14. Online tools 

No 


If YES, then please provide your reasons for this view. 
15. Data protection impact assessments 
No 


If YES, then please provide your reasons for this view. 
16. Governance and accountability 


No 


If YES, then please provide your reasons for this view. 


Q6. Do you envisage any feasibility challenges to online services 
delivering this standard? 


1. Best interests of the child 


Yes 


Implementation of the code could lead to children's online experiences 
changing, which may result in current 'child' or 'under-age' users 
maintaining their current profiles while their peers as new users have a 
different on-boarding experience, resulting in a difference between 
existing and new user experiences. This needs to be taken into 
consideration. 


2. Age-appropriate application 
Yes 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

Challenges around age identification of young people below 18 - even if 
implementing Carnegie-Mellon university tests as part of or after on- 
boarding. 

3. Transparency 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 
4. Detrimental use of data 


No 


5. Policies and community standards 
Yes 


Report Harmful Content.com a service provided by SWGfL for the UK 
Safer Internet Centre is the national reporting hub for reporting online 
harm. Users who have reported content to a provider but are not 
content with the response are able to obtain support from 
reportharmfulcontent.com in terms of advice, support and mediation. 
The UK Safer Internet Centre assesses these reports against the 
providers' terms and through understanding and navigation of terms 
and conditions is able to support users. The service is platform agnostic, 
offering support and mediation to users of 13 platforms. Whilst this can 
be extended to support other providers, their ability to do so could, in 
the initial stages of the product lifecycle, be limited by the size of the 
moderation team, or the finances available to a start-up company. This 
is despite the assertion made that innovation in data ethics may be an 
important competitve differentiator. 

6. Default settings 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

7. Data minimisation 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

8. Data sharing 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

9. Geolocation 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 
10. Parental controls 


No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


11. Profiling 
Yes 


It would be helpful to make the distinction between ‘legitimate’ profiling 
for academic purposes vs 'non-legitimate’ for content provision. 

12. Nudge techniques 

Yes 


It would be useful to provide more clarity on whether,or where, nudging 
in games is acceptable. 

13. Connected toys and devices 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

14. Online tools 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 

15. Data protection impact assessments 

No 


If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 
16. Governance and accountability 


No 
If YES, then please provide details of what you think the challenges are 
and how you think they could be overcome. 


Q7. Do you think this standard requires a transition period of any longer 
than 3 months after the code come into force? 


1. Best interests of the child 


No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


2. Age-appropriate application 
No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

3. Transparency 

Yes 


Given the complexities and current inconsistencies around terms and 
privacy and the lack of an exisiting labelling scheme, we feel that this 
standard will require additional time to enable the creation of an 
appropriate scheme and for providers to adopt this. The period for 
implementation is difficult to be unequivocal on at this stage, but we 
would suggest that a period of 12-18 months would be appropriate. 
4. Detrimental use of data 


No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


5. Policies and community standards 
No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

6. Default settings 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

7. Data minimisation 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

8. Data sharing 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


9. Geolocation 
No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

10. Parental controls 

YES/NO. 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

11. Profiling 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

12. Nudge techniques 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

13. Connected toys and devices 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

14. Online tools 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 

15. Data protection impact assessments 

No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


16. Governance and accountability 
No 


If YES, then please provide your reasons for this view, and give an 
indication of what you think a reasonable transition period would be and 
why. 


Q8. Do you know of any online resources that you think could be usefully 
linked to from this section of the code? 


1. Best interests of the child 
Yes 


Education for a Connected World by UKCIS 
(https://www.gov.uk/government/publications/education-for-a- 
connected-world) This framework describes the digital knowledge and 
skills that children and young people should have the opportunity to 
develop at different ages and stages of their lives. 


2. Age-appropriate application 
Yes 


The UK Safer Internet Centre organises Safer Internet Day 
(https://www.saferinternet.org.uk/safer-internet-day/safer-internet- 
day-2019/impact-safer-internet-day-2019), a national day dedicated to 
raising awareness of online safety challenges and opportunities and is 
part of a global event. This represents a great opportunity to involve a 
wide range of stakeholders raise awareness of the issues. A similar 
approach could be beneficial in raising awareness of this code and the 
age-appropriate requirements. 


3. Transparency 
Yes 


Polisis's tool, Pribot - Ai-powered simple representation of privacy 
terms and conditions. https://pribot.org/ 

UK Safer Internet Centre's Social Media Checklists - source of 
supportive information about priacy and settings across a range of 
social networks. (https://www.saferinternet.org.uk/advice- 
centre/teachers-and-school-staff/teaching-resources/social-media- 
checklists) 

IRLS - Progress in International Reading Literacy Study 
https://www.iea.nl/pirls 

4. Detrimental use of data 


Yes 


e UK Council for Internet Safety (UKCIS) 

e Internet Watch Foundation’s FC Code of Practice 

The UNCRC and forthcoming General Comment on children’s 
rights in relation to the digital environment 


e Any codes introduced following the UK Government’s Online Harms 
White Paper 


5. Policies and community standards 
Yes 


Report harmful content - the national reporting hub for reporting online 
harm (http://reportharmfulcontent.com) 

6. Default settings 

No 


If YES, then please provide details (including links). 
7. Data minimisation 
No 


If YES, then please provide details (including links). 
8. Data sharing 
No 


If YES, then please provide details (including links). 
9. Geolocation 
No 


If YES, then please provide details (including links). 
10. Parental controls 
Yes 


UK Safer Internet Centre - https://www.saferinternet.org.uk/advice- 
centre/parents-and-carers 

Common Sense Media - https://www.commonsensemedia.org/ 
Internet Matters - https://www.internetmatters.org/parental-controls/ 
11. Profiling 

No 


If YES, then please provide details (including links). 
12. Nudge techniques 
No 


If YES, then please provide details (including links). 
13. Connected toys and devices 
No 


If YES, then please provide details (including links). 
14. Online tools 
Yes 


BBC Own it - https://www.bbc.com/ownit 
15. Data protection impact assessments 
No 


If YES, then please provide details (including links). 
16. Governance and accountability 


No 


If YES, then please provide details (including links). 


Q10. Is the ‘Enforcement of this code’ section clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q11. Is the ‘Glossary’ section of the code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q12. Are there any key terms missing from the ‘Glossary’ section? 

No 

If YES, then please provide your reasons for this view. 

Q13. Is the ‘Annex A: Age and developmental stages’ section of the 
code clearly communicated? 

Yes 

If NO, then please provide your reasons for this view. 


Q14. Is there any information you think needs to be changed in the 
‘Annex A: Age and developmental stages’ section of the code? 


No 


Please refer to the developmental progressions described within 
Education for a Connected World 
https://www.gov.uk/government/publications/education-for-a- 
connected-world 


Q15. Do you know of any online resources that you think could be 
usefully linked to from the ‘Annex A: Age and developmental 
stages’ section of the code? 


No 


Please refer to the developmental progressions described within 
Education for a Connected World 
https://www.gov.uk/government/publications/education-for-a- 
connected-world 


We suggest the following amendments to this section: 


1. Paragraph 1: text edit: "... to help you assess what is apporpriate for 
children of broadly that age, or who are working at that age." 


2. Ages 0-5: additional point: Children at this age are likely to focus on 
themselves. 


text edit: "... They have limited capacity for, or understanding of, self- 
control or ability to manage their own time online. .... or watching video 
streams. however, they are often able to use simple tech unaided." 


text edit: "... lawful basis for processing their personal data you need 
informed parental consent." 


3. Ages 6-9: additional sentence under paragraph 3: "Children at this 
age are also unlikely to have a clear understanding of the complexities 
of consent online." 


Additional sentence under paragraph 5: "They need bitesized, 
engageing content to understand important messages." 


text edit: "... lawful basis for processing their personal data you need 
informed parental consent." 


4. Ages 10-12: additional clause under paragraph 1: "... own personal 
device (predominantly smartphones), and online platforms to stay in 
touch". 


Additional sentence within paragraph 5: "... tend towards impulsive 
behaviours. They are likely to perceive risk as only immediate. Parental 
or other support therefore ..." 


5. Ages 13-15: additional sentence in paragraph 3: "They may have a 
strong desire for privacy from their parents, and so therefore may 
operate multiple accounts or profiles, some of which have different 
privacy settings or sharing settings to others. 


text edit in paragraph 4: "... signposting towards sources of age- 
appropriate support, including but not limited to ..." 


Ages 16-17: text edit in paragraph 1: "...cognitively and emotionally, 
and still can take lots of risks online. They should not be expected to 
have the same resilience ..." 


text edit in paragraph 3: "... signposting to other sources of age- 
appropriate support in addition to ..." 


Both sections for ages 13-15 and 16-17 need to take into account 
ensuring "active and informed consent" from young people at these 
ages, and this text should be inserted into the final paragraphs of each 
of these two sections. 


Q16. Is the ‘Annex B: Lawful basis for processing’ section of the 
code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q17. Is this ‘Annex C: Data Protection Impact Assessments’ 
section of the code clearly communicated? 


Yes 
If NO, then please provide your reasons for this view. 


Q18. Do you think any issues raised by the code would benefit from 
further (post publication) work, research or innovation? 


Yes 


There is a degree of work to be done to help frame users' expectations 
in relation to the Code, and to help build their understanding of the 
measures put in place that they might be coming across in their online 
use. 


Building a successful and thriving online world provides extraordinary 
opportunities for everyone, and user confidence and trust in the 
services they use is key here. Education for under 18s about what the 
Code means for them, will help better inform them, frame their 
expectations, and make them aware when they feel the standard has 
not been met so they can report. Awareness raising for parents, carers 
and the children's workforce will contribute towards children and young 
people's undesrtanding too, and contribute towards user confidence and 
trust, as well as informed decision-making between adults and children 
around access to online services. 


There is also scope for an impact assessment in relation to children and 
young people and their parents. It would be helpful to hear from this 
target audience, what the impact of the Code has been. This should 
focus on whether the changes have been noticeable as a result of the 
Code, what forms have been particularly noticeable, whether young 
people feel more or less confident about how data online is collected 
and used, and what options and rights they have in relation to this. It 
would also be important to ask them whether being online feels the 
same experience as it was before, what has changed for the better and 
what for the worse. 


Section 2: About you 


Are you: 


A body representing the views or interests of children? 


Please specify: 


A body representing the views or interests of parents? 


Please specify: 


A child development expert? 


Please specify: 


An Academic? 


Please specify: 


An individual acting in another professional capacity? 


Please specify: 


A provider of an ISS likely to be accessed by children? 


Please specify: 


A trade association representing ISS providers? 


Please specify: 


An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the 
public or a parent)? 


An ICO employee? L] 
Other? 
Please specify: 


Representatives from the UK Safer Internet Centre 


Thank you for responding to this consultation. 


We value your input. 


